During the investigation of a security incident, an analyst has narrowed down the potential causes to a shortlist of vulnerabilities. Which of the following actions is most effective in determining the actual exploited vulnerability that led to the compromise?
Analyzing the correlation between exploit signatures and network traffic.
Examining the less secure network paths to find the most plausible point of entry.
Reviewing public CVE databases for matches with the shortlisted vulnerabilities.
Verifying patch levels and update histories for the affected systems.